Operation DarkUniverse APT Framework

The DarkUniverse APT group targeted civilians and military organizations with spear-phishing emails with an attached malicious Microsoft Office document that contained an embedded executable file. Cloud storage was mainly used for command and control servers which were used to upload and download a range of modules and sensitive information.